0ccc56fbaaa45e83fedf00dd3bb7f0b27a031ec6e501480a205bb08482e11b98

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:12

Target

480.exe
Size

52KB
MD5

6909eda515c9f66cf8b1986377ad3a50
SHA1

74cbdd867c09a44e03e607458e2570c2c83a9386
SHA256

0ccc56fbaaa45e83fedf00dd3bb7f0b27a031ec6e501480a205bb08482e11b98
SHA512

991eea9456095dd45561cc0e0a460a08c7ce48665e39281bac6fb8e756fdcc9524be3cd43dce2f96e65b87a413fcb8380a61a2c127fb0fc94cc028f0bd85d17b
SSDEEP

384:g6Ye6ubKjnokT71XRvTokc96ubhT071u7Oeb73RH7B7GYdF8Txpw/+KsLIb+VckJ:g6Ye6u2zXMcdeZpyQ/DycBZPql2Ra

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
884	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 884	2992	480.exe	28
PID 2992 wrote to memory of 884	2992	480.exe	28
PID 2992 wrote to memory of 884	2992	480.exe	28
PID 2992 wrote to memory of 884	2992	480.exe	28

C:\Users\Admin\AppData\Local\Temp\480.exe
"C:\Users\Admin\AppData\Local\Temp\480.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 420
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:884

memory/884-3-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/884-6-0x0000000001E10000-0x0000000001E11000-memory.dmp

Filesize
4KB

Download
memory/2992-0-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2992-1-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2992-2-0x0000000001EE0000-0x0000000001F20000-memory.dmp

Filesize
256KB

Download
memory/2992-4-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2992-5-0x0000000001EE0000-0x0000000001F20000-memory.dmp

Filesize
256KB

Download